Itinerary & General Comments

   Prior to departure for Lisbon, meetings were held in CTC's office on two separate occasions between CTC officers and [our client].  Problem areas were outlined, requirements were reviewed and suggestions for proceeding with the security survey were outlined.  Once agreement was reached, plans were made for Mr. Rustmann to visit Portugal, Spain and possibly France to conduct a security survey of that end of the operation.  Following is an outline of that visit.

• Sunday, 14 March:  Mr. Rustmann departed home for Palm Beach International airport at 1200 hours.  The flight departed PBI for Newark at 1415, and from Newark for Lisbon at 2005. 





• Monday, 15 March: Arrival in Lisbon at 0730.  A lunch meeting was held with the warehouse manager to review warehouse procedures.  It was learned that the errant January shipment had not been decoded and that the purchaser probably was generally lax in its security procedures, resulting in the famous fax falling into the wrong hands.  A penetration of US Customs at the port of Miami may have contributed to the flap.  The errant shipment resulted in the termination of the relationship with [that purchaser] in Miami.  At the present time, the only purchaser in the US is [a company], which runs a much tighter ship.  Briefings included background on the three main product lines.  The fact that [Product Line A] was recently purchased by a German company will probably result in tighter inventory control and more difficult diversions.  Pallets were examined and identifying company marks were removed.  It was suggested that all future pallets be wrapped in black and the only identifying mark be the pallet number.  It was also suggested that each pallet be examined with a metal detector to attempt to determine if a beacon (tracking device) had been installed.  In the late afternoon a metal detector was purchased to check the pallets for beacons.





• Tuesday, 16 March: Back at [the warehouse] in the morning to check the pallets and load the shipment in a container.  We found that the metal detector was useless on pallets containing hairspray (metal containers).  The truck arrived with the container and we noted that the bottom of the container could not be examined since it was resting on the truck bed. [The warehouse manager] briefed us on how the container is assigned, then the truck is sent to the container yard where it is loaded on the truck.  Inspection should be done at this location in the future.  Mr. Rustmann accompanied the container to the port in the late afternoon in an effort to examine the bottom of the container, but he was not permitted out of the truck inside the customs area and therefore could not do a good inspection.  He did not detect any surveillance of the truck to the port, however.  





• Wednesday, 17 March:  The morning began at the offices of [Product Line A's] General Manager.  Morning meetings through lunch were held with [Product Line A's] deputy and accounting head.  Afternoon meetings were held with [the General Manager] and they became quite tense.  [The deputy] reported that the President of [Product Line A] told him he had intercepted a full pallet of products, and from the way he described the pallet it could only be the kind sold to [the previously mentioned purchaser].  The pallet was sent in May and invoiced in June.  (Follow up: Where was the pallet found? Circumstances?)  [The General Manager] is a very sharp businessman but he clearly met his match in [our client]. The two butted heads for a couple of hours but in the end [our client] seemed to prevail. [The General Manager] clearly needs [our client's company] to keep his sales up, but he thinks he is the only game in town.  [Our client's company] should look for alternative sources and try to shake [the General Manager] up a bit by backing off purchasing from [the General Manager] for a month or two.  [The General Manager] does not want to get caught and seems to be impressed with [our client's] security efforts to protect him.  [Product Line A's] president doesn't know the details of the diversions, but he does know that Spain is diverting. Spain is [Product Line A's] second largest market.  The president did not mention [our client] specifically.  He has already cut distribution to Brazil and knows that Miami and New York are diverting and he may cut distribution to them as well.  He is probably under pressure from [a German company].  An inspection of the shipment was made at the [Product Line A] warehouse in Spain.  [The General Manager] had disguised the end-users of the pallets by placing fake addresses over the pallet numbers.  This should be continued.  We removed the fake addresses leaving only the pallet numbers showing for shipment.  Back at the hotel [our client] discussed coding.  He said the trackmaster bar code scanning system helped identify [the General Manager's] products diverted in several locations.  If at all possible, codes should be removed before delivery to the US purchaser.  The purchaser should not be relied upon to do it.  Again, this is more to protect the distributor than anyone else.  Although the [US purchaser] is decoding at the moment, this should be done by [our client].





• Thursday, 18 March:  The truck arrived at about 0930.  The pallets were loaded and two vehicles countersurveilled the load from Spain down to the warehouse.  Briefings on countersurveillance procedures were given.  No surveillance was detected during the drive. Pallets were unloaded and placed in the warehouse.  This is a much neater and competent operation than the [other] operation.  The shipment was left here.  There will be two separate shipments coming from Spain that will join up with this one.  All of the pallets will then be loaded into containers and taken to the port to leave next Tuesday.  Due to the lack of time and the delay of the arrival of the shipments, no inspection was done of the containers and no countersurveillance accompanied the shipment to the dock.  This should be SOP in the future, however.   

Procedures and Recommendations

   The following observations and suggested procedures are the result of a week-long survey of existing procedures concerning the purchase, warehousing, packaging, an exporting of cosmetic products from suppliers in Portugal and Spain to the US.  The list includes security procedures already in effect at the time of the survey and additional suggestions.  The list is by no means complete; operational procedures should be reviewed and adjusted on a regular basis to assure the best security possible.

   1.       Receiving Merchandise From Suppliers: 

• At present there is an over-reliance on one supplier, [the General Manager]. Alternate sources of merchandise should be found and utilized, even if they are not as convenient or economical as the [General Manager] source.  

• Merchandise received from suppliers should be delivered on new pallets (i.e. not the pallets originally used for shipment from the US) and wrapped in black plastic wrap.

• Pallets should be clearly numbered and marked for delivery to existing clients within the country of distribution rights.  These markings should be placed on a sheet of paper on the pallet that can be easily removed, revealing only the pallet number underneath (i.e. once the outer sheet is removed there is nothing on the pallet to indicate the end-user).  

• An inspection of the pallets in the supplier's warehouse should be made prior to moving to the purchaser's warehouse.  If possible, the inspection should include a spot check of each pallet before the pallets are wrapped to assure nothing other than the merchandise (e.g. beacon/tracking device) is included in the shipment.  

• Loading of the shipment on a truck controlled by the purchaser should be observed, and the shipment should be countersurveilled to the purchaser's warehouse.

2.       Procedures at the Purchaser's Warehouse: 

• The purchaser's warehouse should be used to control and consolidate shipments coming from various suppliers.  During unloading at this point the papers that identify the (fictitious) end-users should be removed from each pallet, leaving only the pallet numbers underneath. The unloading/stacking of pallets procedure should be observed.  

• Additional inspection of each pallet with a metal detector at this point is optional. (Note: The metal detector is useless on pallets that contain aluminum spray cans, etc.  The point here is to assure, to the extent possible, that no beacon/tracking device has been placed within any of the boxes on the pallets.)

• Once the shipment has been consolidated and is ready for export a container is rented and a truck is sent by the warehouse to the container yard where the container is placed on the truck bed.  This loading procedure should be observed, since it is the only time a visual inspection of the bottom of the container can be made.  The bottom of the container should be examined for possible beacon/tracking devices attached to the inside ridge running along the length of the container.  

• The empty container should be countersurveilled back to the warehouse. Additional inspection of the interior, top and outsides of the container can be accomplished at this point.  

• The loading process should be observed to assure that the load has not been tampered with in any way.  

• Once the loading process is complete the container should be countersurveilled from the warehouse to the customs area of the port.  

3.      Communications and Security:  

Lessons should be learned from the discovery of the errant January shipment.  There are a number of ways the opposition can intercept communications regarding shipments.  They include:  trash operations at any of the offices in the chain; a human source penetration of any of the points in the chain; communications intercept (e-mail, fax, telephone, etc.); or bribery of customs officials at one of the ports.  

• Fax transmissions can be made secure by purchasing secure fax machines for each of the principle parties (seller, distributor, US purchaser).  This can be expensive however, so the recommendation is not to use faxes for transmission of purchase orders, contracts, or any other information regarding diverted shipments.  Amex, DHL and other carriers should be used for this purpose.  (Note: Additional information and prices on secure fax can be provided on request.)  

• Digital cell phones are actually quite secure, but care should still be taken when discussing "classified" information concerning shipments.  Code names should be assigned to suppliers, shippers, shipments, etc. and these should be used in telephone conversations (e.g. Peter will be arriving in Boston on the 17th = Shipment #7 will be arriving in Miami on the 15th (subtract two days).  (Note: Code words - not double-talk - should be used in all correspondence/conversations regarding confidential shipments.)

• E-mail is an excellent (fast, cheap) means of communication and it can be made very secure by using an inexpensive and user friendly encryption system that can be purchased on disk or downloaded from the internet. One of the most widely used programs is called "PGP."  (PGP stands for "Pretty Good Privacy.") Encryption/decryption keys can be sent along with messages to any recipients, even those outside of the normal communication channels.  The system can therefore be used with buyers, distributors, etc. as well as between employees and clients.  (Note: Additional information can be provided on request.)  

• To avoid being the victim of a trash operation, paper shredders should be installed in all offices and all correspondents (suppliers, purchasers, shippers, etc.) should be encouraged to do the same.  All documents and correspondence (faxes, letters, etc.) should be shredded before throwing in the trash.  Shredders are fairly cheap and readily available in office supply stores throughout the world.  

• The use of "cutouts" for fax and mail correspondence should be considered.  For example, in the US a mailing address and fax number can be obtained easily and cheaply at neighborhood "Kinkos" and "Mailboxes, Etc." stores.  The use of these cutouts when corresponding with suppliers and purchasers breaks the link between them and [our client].  Faxes and mail (regular and overnight) can be received (in true name or alias) at these locations.  These are especially useful when alias names (personal and company) are used, or when separate companies are set up to send and receive shipments.  

   4.      Miscellaneous Recommendations:  

• [Our client] should not be the only purchaser in Europe and [our client] should not be the only US seller. A number of US and European companies should be established and used in conjunction with cutouts to purchase and sell diverted merchandise.  

• A central, secure location should be established to receive merchandise from Europe and elsewhere, and to forward merchandise to the US.  This should be a place totally under the control of [our client].  Morocco has been suggested as a possible location.  Import/Export companies (plural) should be established in Morocco for the handling of all shipments in and out of the country.  The cooperation of customs officials should be obtained, and loyal, discreet warehousing and freight handling facilities and individuals should be secured. (Note:  CTC is in a position to offer assistance in this regard.  CTC's Moroccan representative is very familiar with port facilities and officials, customs officials, warehouse operations, etc. in Morocco.)  

• Decoding:  At present, [the US purchaser] is running its own decoding operation in Miami.  Other purchasers simply don't bother.  Ideally, every diverted item that reaches store shelves in the US should be untraceable.  The protection this affords the suppliers is enormous and will result in greater risk taking (in terms of merchandise they will sell for diversion) on their part.  The decoding operation should be done by [our client] to assure its effectiveness.  The operation should be set up in a central location (like Morocco), or at least at some location before the merchandise reaches the US buyer.  

• Over-reliance on any supplier, shipper, warehouse facility, port, purchaser, etc. should be avoided.  The opposition should never be in a position where the penetration of a single facility will give them information on diverted shipments. While there are advantages in dealing with loyal and trusted people, the disadvantage is that once the opposition knows a particular facility is used extensively, investigation and surveillance of that facility is all it needs to uncover the entire diversion trail.